Falhas do tipo CWE-89

12.877 resultados

Injeção de SQL

Fraqueza onde entrada do usuário é concatenada diretamente em comandos SQL sem validação ou sanitização, permitindo que um atacante insira código SQL malicioso. O banco de dados executa comandos não intencionais, comprometendo confidencialidade, integridade e disponibilidade dos dados.

Exemplo

Um formulário de login concatena o usuário digitado direto na query: `SELECT * FROM users WHERE login = '` + input + `'`. Se o usuário digita `admin' OR '1'='1`, a query vira `SELECT * FROM users WHERE login = 'admin' OR '1'='1'`, retornando todos os usuários e burlando autenticação.

Como mitigar

Use prepared statements (consultas parametrizadas) com placeholders, nunca concatene entrada do usuário. Valide e restrinja entrada (whitelist), aplique princípio do menor privilégio na conta do BD e use WAF como camada adicional.

CVE-2023-31628HIGHAn issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQLEPSS 0.9%CVE-2023-31626HIGHAn issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted EPSS 0.9%CVE-2023-31614HIGHAn issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoSEPSS 0.9%CVE-2023-31609HIGHAn issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via cEPSS 0.9%CVE-2023-31625HIGHAn issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQEPSS 0.9%CVE-2023-31608HIGHAn issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafteEPSS 0.9%CVE-2023-31621HIGHAn issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted EPSS 0.9%CVE-2023-31629HIGHAn issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crEPSS 0.9%CVE-2023-31612HIGHAn issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.9%CVE-2023-31617HIGHAn issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via craftEPSS 0.9%CVE-2023-4543MEDIUMIBOS OA export&contactids=x sql injectionEPSS 0.9%CVE-2023-27871HIGHIBM Aspera Faspex information disclosureEPSS 0.9%CVE-2023-29095HIGHWordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-22319HIGHA sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A specially-crafted network EPSS 0.9%CVE-2023-20010HIGHA vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications EPSS 0.9%CVE-2023-34168HIGHWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL InjectionEPSS 0.9%CVE-2023-4928HIGHSQL Injection in instantsoft/icms2EPSS 0.9%CVE-2023-27233HIGHPiwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.EPSS 0.9%CVE-2022-40315CRITICALA limited SQL injection risk was identified in the "browse list of users" site administration page.EPSS 0.9%CVE-2023-5004CRITICALHospital-management-system-in-php 378c157 - Blind SQL InjectionEPSS 0.9%